Received: by 10.192.165.148 with SMTP id m20csp4217515imm; Mon, 30 Apr 2018 14:04:46 -0700 (PDT) X-Google-Smtp-Source: AB8JxZpvDLmymk6aW3kOUUz630/Fi2a4C2oaBmDrGloqyIRGgekSxAJTTaveC2JIfVecGLlRVbTC X-Received: by 10.98.47.2 with SMTP id v2mr13326751pfv.239.1525122286612; Mon, 30 Apr 2018 14:04:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1525122286; cv=none; d=google.com; s=arc-20160816; b=j8+7fR23hNN13v4mzEEgsEOGYVLBBIyUjiVlLgLZYZr48xbu4rtCXOVRs3AXzXpyai jI1eAOqsxaNxTeBh8u92MCGdDLjwXkgbay1y3WhAFZJ58x0KhaIoRkO9LvFl8N0ITxzO 9oeD5IgPDSnRXYcWWshwTvDzUC6Vj6l2LpNcfLtfqFzLuXrDU7FkAqsP8yiNb4o0liv1 vdUuPHPkhPF1nM+HzRh/8sZxYCEyCvRSAJh7i4ZLPkHyOkxo6UUct9+5q7xg1akA+YnF gKc4ahfoQ1vka1hZagnGkhLSxNO7QxtdlsWl9caAIu9sYut85Fyf7jwhOtuZzFCX9nBB /hoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:references :in-reply-to:mime-version:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=VYPqd0EPnstIXTaxNQWFz6GHqHLI1+Ex0cegRHPwv2s=; b=EF4OczQNRpOmAopFUY30RCaj/6SwTz935KIWLlXQ7zlEUSfHVN3NfK/5/KdZEMknPy ei6sqTZGOSISd6AVb0EPJRhTdQxUnYFPtOR+4y8JiFWo2bnc1nwMmEqhUIqgUy34poFZ Mq4Tncp1lkDXSRDEQUtwfRUlJjjqP7IuCeujy69HDkBWUVdb3x+YQz5j6+wScJhThSCn hLLAsb6PPs/Swz1z1pvpz0Gs7LkRN/n1C9FNMwD7aEWh0ZqPgoEIBf2+B8W5NEj3wgh0 QzI8snAaakHRvv5qEzU+hr+4hTttAm8EDn0TePrGgyPfwJ7P1OZLu9Iiqaf8Yf82+fQc YVhw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=m91my8Sf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g15-v6si8272270pln.526.2018.04.30.14.04.32; Mon, 30 Apr 2018 14:04:46 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=m91my8Sf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755383AbeD3VDJ (ORCPT + 99 others); Mon, 30 Apr 2018 17:03:09 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:47873 "EHLO out2-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755281AbeD3VDD (ORCPT ); Mon, 30 Apr 2018 17:03:03 -0400 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id 0F4C5213CE; Mon, 30 Apr 2018 17:03:03 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute7.internal (MEProxy); Mon, 30 Apr 2018 17:03:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:in-reply-to:message-id:mime-version :references:references:subject:to:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=VYPqd0EPnstIXTaxNQWFz6GHqHLI1+Ex0cegRHPwv 2s=; b=m91my8SfajNn2EXW6LmriJf453SvrUeIKt7sCQRHCR65xv8w0C0XhCIWj wiJjtpLOZcPZRb1PmRaISWuqf0adggFVBsOJQuRjPh5dj/M+0pT6KMym2qHUlMKb 3A3wXVWi9GjOcLk5IC9F5wtwWM/BnBHN4Vc7egu80t1vdER43ccvHeaW1J8rZfqZ QM3bZCNcc1XKGwZ2cQ5egroUJ8s9qbZ1rGZ/Kt22il17g7N1w7UNH7sCzDc+4TAk QKHRdX5BC7x9tPLoFeqIK7WAodXfzYSN0s+bnIqWz+izT1Np7HWbOdJOAh5M5Z4m BwZkwqbSRwULEU20yJHwsOtiqjQDA== X-ME-Sender: Received: from localhost.localdomain (ip5b40bfaa.dynamic.kabel-deutschland.de [91.64.191.170]) by mail.messagingengine.com (Postfix) with ESMTPA id D53F4E4924; Mon, 30 Apr 2018 17:03:01 -0400 (EDT) From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= To: xen-devel@lists.xenproject.org Cc: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= , stable@vger.kernel.org, Boris Ostrovsky , Juergen Gross , netdev@vger.kernel.org (open list:NETWORKING DRIVERS), linux-kernel@vger.kernel.org (open list) Subject: [PATCH 4/6] xen-netfront: add range check for Tx response id Date: Mon, 30 Apr 2018 23:01:48 +0200 Message-Id: <960c6d6300fd3450ae9fb1de1c412bef7dbae992.1525122026.git-series.marmarek@invisiblethingslab.com> X-Mailer: git-send-email 2.13.6 In-Reply-To: References: MIME-Version: 1.0 In-Reply-To: References: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Tx response ID is fetched from shared page, so make sure it is sane before using it as an array index. CC: stable@vger.kernel.org Signed-off-by: Marek Marczykowski-Górecki --- drivers/net/xen-netfront.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 934b8a4..55c9b25 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -394,6 +394,7 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) continue; id = txrsp.id; + BUG_ON(id >= NET_TX_RING_SIZE); skb = queue->tx_skbs[id].skb; if (unlikely(gnttab_query_foreign_access( queue->grant_tx_ref[id]) != 0)) { -- git-series 0.9.1